feat: add INSECURE oidc email fallback flag for IdP brokers (#26751) - #26819

Resolved the merge conflict from the automated backport of #26751.

What was done

• Ran the manual cherry-pick the bot requested: git cherry-pick -x -m1 ad355aeaa9a10d44c8b910236d6e293e321e9d2f.
• Every file auto-merged except coderd/userauth_test.go. That conflict bundled the three new tests from feat: add INSECURE oidc email fallback flag for IdP brokers #26751 together with an unrelated OIDCSuspended test that exists on main but not on release/2.33. I kept only the three intended tests (OIDCInsecureEmailFallbackAllowed, OIDCInsecureEmailFallbackPreservesOriginalLogin, OIDCInsecureEmailFallbackDoesNotCreateUsers) and dropped the unrelated OIDCSuspended test, placing them before OIDCConvert to match the release branch layout.

Verification

• go test -c ./coderd/ compiles.
• go test ./coderd/ -run 'TestUserOIDC' passes (full suite plus the three new tests).
• go test ./cli/ -run TestServerYAMLConfig (golden config) passes.

The PR now shows exactly the intended diff (10 files, +254/-6). mergeStateStatus is BLOCKED only because of branch protection (required review/checks), not conflicts.

Resolved by Coder Agents on behalf of @f0ssel.

👋 Hey @github-actions[bot]!

This PR is targeting the release/2.33 release branch, but its title does not start with fix: or fix(scope):.

Only bug fixes should be cherry-picked to release branches. If this is a bug fix, please update the PR title to match the conventional commit format:

fix: description of the bug fix
fix(scope): description of the bug fix

If this is not a bug fix, it likely should not target a release branch.